CVE-2024-24787

unknown

Published 2024-05-08 · Modified 2026-02-04

CVSS v3

—

CVSS v2

—

VIR risk

—

Description

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2024-24787.html

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2024-24787

OS impact

OS	Version	Status	Fixed in
debian	bookworm	fixed	`0`
debian	bullseye	fixed	`0`
sles		affected

Package impact

Ecosystem	Package	Vulnerable	Fixed
Go	toolchain	`>=1.22.0-0,<1.22.3`	`1.21.10`

References

https://go.dev/issue/67119
https://go.dev/cl/583815
https://groups.google.com/g/golang-announce/c/wkkO4P9stm0
https://security-tracker.debian.org/tracker/CVE-2024-24787
https://www.suse.com/security/cve/CVE-2024-24787.html

Verify integrity in audit chain (admin only). AS-IS.